Responsible Disclosure & Cyber Security

Version 1.0 · Last updated: 2026

Related: Terms · Privacy · Legal Center

HatchMatch Group welcomes coordinated reports from security researchers. This policy sets out how to report suspected vulnerabilities safely and lawfully.

1. Scope

hatchmatchgroup.com, its subdomains and platform APIs owned by HatchMatch Group. Third-party services, sister platforms and supplier systems are out of scope.

2. How to report

Email security@hatchmatchgroup.com with: a clear description, reproduction steps, affected URL / component, impact, and any proof-of-concept. Do not include third-party personal data. We aim to acknowledge within 3 business days.

3. Rules of engagement

• Test only against your own accounts and non-destructive test data.
• Do not exfiltrate, retain, publish, sell or share personal data.
• No denial-of-service, brute force, credential stuffing, physical intrusion, social engineering of staff or users, or spamming.
• No scraping, mass automation or reverse engineering beyond what is strictly necessary to demonstrate an issue.
• Stop testing immediately if you encounter personal data or business-critical data and notify us.
• Keep the vulnerability confidential until we confirm remediation or authorise disclosure.

4. Safe harbour

Where reports are made in good faith, follow this policy, respect applicable law and avoid privacy violations, HatchMatch Group will not pursue civil action or ask law enforcement to investigate the researcher, and will treat the activity as authorised access under the Terms of Service. Activity outside this policy is not authorised.

5. Recognition

HatchMatch Group does not currently operate a paid bug-bounty programme. We are happy to credit researchers publicly on request once a report is validated and remediated.

6. Governing law

This policy is governed by the laws of the Republic of Cyprus with exclusive jurisdiction of the competent courts of Cyprus.

7. Contact

security@hatchmatchgroup.com